Unit 42: CL-STA-0954 (UNC5820) used FortiJump on a telco MSP's FortiManager to steal configs for 500+ FortiGates, cracked SSL VPN passwords, then planted the memory-only PEERSTITCH implant via FortiOS auto-script path traversal CVE-2025-61624

Palo Alto Networks Unit 42 published on 14 October 2026 its investigation of a long-running intrusion at a telecommunications managed service provider, which it tracks as CL-STA-0954 (also known as UNC5820) and says overlaps with suspected nation-state activity. Initial access, in September 2024, came through CVE-2024-47575 (FortiJump), a missing-authentication flaw in FortiManager's FGFM management channel on TCP 541 (CVSS 3.1 9.8). The attackers registered a rogue virtual FortiGate, then exfiltrated an archive with running configurations, cryptographic material and database files covering more than 500 managed FortiGate firewalls that protected the provider and its clients. After a long dwell period they used FortiManager to push packet-capture rules to downstream firewalls, targeting unencrypted HTTP, TFTP, RADIUS and LDAP traffic. Unit 42 confirmed that admin and SSL VPN passwords stored as reversible ciphertext in the stolen configs could be brute-forced, and the attackers logged in to perimeter firewalls over SSL VPN with legitimate credentials. They then exploited CVE-2025-61624, a path traversal in the FortiOS CLI auto-script feature that lets an admin write files as root (Fortinet FG-IR-26-122, CVSS 5.4), to drop PEERSTITCH on selected firewalls. PEERSTITCH is a statically linked ARM64 injector that uses ptrace to patch the miglogd logging and iked IPsec daemons in memory. It leaves no binary on disk, opens no listening port and makes no outbound connection, instead hiding its communications in traffic those daemons already handle. Unit 42 did not examine the client networks, so client exposure is configuration and credential material rather than confirmed intrusion. IOCs in the report include 45.32.41[.]202, 198.199.122[.]22, 23.240.77[.]233 and 47.18.167[.]159. CISA added CVE-2025-61624 to its Known Exploited Vulnerabilities catalog on 16 October 2026 (covering FortiOS, FortiPAM, FortiProxy and FortiSwitchManager), with a 19 October deadline for US federal agencies and a forensic-triage requirement. Primary: Unit 42; vendor: Fortinet FG-IR-26-122.

Product

Fortinet FortiManager (initial access) and FortiOS on managed FortiGate firewalls (privilege escalation and implant)

Versions

CVE-2024-47575: FortiManager 7.6.0, 7.4.0–7.4.4, 7.2.0–7.2.7, 7.0.0–7.0.12, 6.4.0–6.4.14, 6.2.0–6.2.12 and matching FortiManager Cloud. CVE-2025-61624: FortiOS 7.6.0–7.6.4, 7.4.0–7.4.9 and all 7.2, 7.0 and 6.4 releases; also FortiProxy, FortiPAM and FortiSwitchManager per CVE record

CVSS

9.8 (CVE-2024-47575); 5.4 (CVE-2025-61624)

Exploited in Australia?

unknown

Patch to

Upgrade FortiManager past the FG-IR-24-423 affected ranges and keep TCP 541 off the internet. Upgrade FortiOS to 7.6.5 or 7.4.10 or later per FG-IR-26-122 (move off 7.2, 7.0 and 6.4). If a FortiManager was ever exposed, assume its managed firewall configs were stolen: rotate admin, SSL VPN, RADIUS/LDAP and IPsec secrets, look for unknown registered devices and sniffer or auto-script objects with ../ names, and check miglogd and iked for injected memory.

Primary: Palo Alto Networks Unit 42 — FortiManager CVE-2024-47575 intrusion and PEERSTITCH malware (14 Oct 2026) · Vendor: Fortinet PSIRT FG-IR-26-122 — FortiOS auto-script path traversal CVE-2025-61624 (FortiJump advisory: FG-IR-24-423) · CVE: CVE-2025-61624, CVE-2024-47575 · Fortinet PSIRT FG-IR-24-423 — FortiManager missing authentication in fgfmsd, CVE-2024-47575 (Oct 2024)

vulnerabilities network